librarian.net

The American Library Association was one of many companies and public interest groups that helped create a set of best practices for RFID. They include these three general principles about RFID, as it relates to privacy:

Technology Neutrality: RFID technology in and of itself does not impose threats to privacy. Rather privacy breaches occur when RFID, like any technology, is deployed in a way that is not consistent with responsible information management practices that foster sound privacy protection.

Privacy and Security as Primary Design Requirements: Users of RFID technology should address the privacy and security issues as part of its initial design. Rather than retrofitting RFID systems to respond to privacy and security issues, it is much preferable that privacy and security should be designed in from the beginning.

Consumer Transparency: There should be no secret RFID tags or readers. Use of RFID technology should be as transparent as possible, and consumers should know about the implementation and use of any RFID technology (including tags, readers and storage of PII) as they engage in any transaction that utilizes an RFID system. At the same time, it is important to recognize that notice alone does not mitigate all concerns about privacy. Notice alone does not, for example, justify any inappropriate data collection or sharing, and/or the failure to deploy appropriate security measures. Notice must be supplemented by thoughtful, robust implementation of responsible information practices.

Hi. I’m back and very tired. Midwinter went fairly well from my perspective. Council meetings seemed effective. I got to see most of the people i tried to see and had some nice serendipitous meetings with others. My company was part usual suspects and part people I’d never met before including a healthy dose of library students. I learned things. I took a lot of public transportation in an unfamiliar city. I stayed within my budget and I got home feeling smarter than when I left. I have a stack of paperwork that I’d like to share parts of with you but it will need to wait until the weekend.

In the meantime, while we were all at the meeting, this happened “City stalls FBI access in library” referring to the librarian at the Newton Free Library in Massachusetts who wouldn’t let FBI agents in to search library computers without a warrant after there had been emailed threats directed towards Brandeis University sent from one of the library computers. According to an article in the Boston Herald, this was done with the mayor’s knowledge and backing but everyone seems set to blame the librarian anyhow. This was a big enough news items to be the butt of a lot of jokes on talk radio by the time I was driving home from the airport. I’m just starting to read about this story, but correct me if I’m wrong, couldn’t the agents have just asked for the data on the computers, using the USA PATRIOT Act as their legal justification? This seems like a case where they were reluctant to for some reason. The Boston Globe article on the subject says this

[B]y the time a warrant became an issue, law enforcement officials had determined there was no imminent danger and decided to cooperate with Newton officials, Marcinkiewicz said. She said no arrests had been made as of yesterday afternoon. [emphasis mine]

From the Daily Kos, my comments, and I’m sure many other places. Federal agents’ visit was a hoax Student admits he lied about Mao book

Two stories in Southcoast Today [also in print in the Standard Times] following up on the Homeland Security/ILL report from yesterday. ‘Little Red Book’ story gets wide publicity , an article reporting on the publicity and with several statements from additional folks involved, most notably Homeland Security officials calling the scenario described “unlikely”. Also UMass Dartmouth statement on “Little Red Book” denying that they passed on any confidential information to agents or anyone else. [thanks aaron]

A student did an ILL for a specific version of Mao’s Little Red Book and wound up getting a visit from Homeland Security. Obviously, there is more to this story than the short news article, but the article alleges that the Department of Homeland Security monitors Interlibrary Loan requests.

update from the bs detector alert: An ALA Councilor notes that there are two versions of this story circulating with different names attached which definitely sounds fishy and makes it worth further investigation into what exactly is going on. Other councilors have emailed the prof from UCSC mentioned in the second article and he said it was the first he’d heard of it. I’ve emailed the reporter and one of the professors cited in the recent article and I’ll let you know what I find out, if anything. Fellow Councilor Rory Litwin has posted this follow-up to the Council list with more first hand information from one of the profesors involved. I posted a follow-up including some feedback I’d gotten from the reporter of the most recent article. BoingBoing is faster with the summary action than I am.

This is all coming on the heels of some unpleasant revelations about the current administration’s use of the National Security Agency to surveil domestic targets without getting FISA court approval. Who would have thought that this decade would be the one where all llibrarians learned what FISA stood for? How many of you watched CSPAN a little more carefully than usual this weekend [or is my house the only house that does this] to see what happened with the USA PATRIOT Act?

EFF’s blog has a post about a new way libraries could accidentally infringe on patron privacy. Some common color laser printers have the ability to encode uniquiely identifying and traceable information into pages they print. If you care enough about patron privacy to not reveal if a patron has a library card, would you care enough to not reveal that they have used your computers/printers?

According to experts, several printer companies quietly encode the serial number and the manufacturing code of their color laser printers and color copiers on every document those machines produce. Governments, including the United States, already use the hidden markings to track counterfeiters.

Peter Crean, a senior research fellow at Xerox, says his company’s laser printers, copiers and multifunction workstations, such as its WorkCentre Pro series, put the “serial number of each machine coded in little yellow dots” in every printout. The millimeter-sized dots appear about every inch on a page, nestled within the printed words and margins.

Libraries Say Yes, Officials Do Quiz Them About Users, in the NY Times today, according to the results of a recent ALA survey. While this is not evidence of USA PATRIOT Act abuses per se, it points to increasing concern on the part of law enforcement of what people are reading [the article points to a cases of libraries being asked for a list of patrons who had checked out a book about Osama bin Laden] in ways that compromise state library privacy laws. As of this morning, ALA has missed a chance to capitalize on this good press by having anything at all mentioning this study on the front page of their web site, pity.

Ms. Sheketoff at the [American] library association acknowledged that critics of the study may accuse the group of having a stake in the outcome of the Patriot Act debate. “Sure, we have a dog in this fight, but the other side has been mocking us for four years over our ‘baseless hysteria,’ and saying we have no reason to be concerned,” she said. “Well, these findings say that we do have reason to be concerned.”

The Canadian Library Assocation posted a privacy briefing on how the USAPA was going to affect Canadian libraries [pdf]. Tom Morris asks the British Library what he can expect from them in terms of patron privacy in the age of the USA PATRIOT Act, the response is not encouraging. [lj]

We all probably know that section 215 of the USA PATRIOT Act will sunset at the end of this year. What you may not know is that people have been working hard in the Senate to make sure that it doesn’t. The ACLU is reporting that the Senate Select Committee on Intelligence approved legislation which will expand and reauthorize sunsetting parts of the USAPA. Declan McCullagh has a few more details. The bill [pdf] should be heading to the Senate floor. Now might be a good time to contact your elected representative.

I would really like to know what privacy or security problems public libraries have that need to be solved with expensive biometrics equipment and patron ID-ing via fingerprints? Please note that I am not related to Naperville Public Library director Mark West who seems to have a willful misunderstanding of the difference between a fingerpint and a bar code. Please also note that US Biometrics who sold the library the system is headquartered in Naperville Illinois. Here are some more specifics about their arrangement with the library. Note the obligatory library pervert tossed in to the article just to make people think that this level of increased security is necessary for some crime-fighting reason. If you read through to page 2 of the article you’ll notice that only one other library system in the US uses fingerprint IDs on a voluntary basis. The library serves 400,000 people. 1,787 patrons use it. How do you think that works out, in terms of return on investment? [thanks jill]